DNS

Two ways to hold a zone

Keep your DNS provider and connect KLYRN to it. KLYRN says when a name does not point here and gives you one button that fixes it. Or make this server the nameserver for the domains it hosts. The panel then tells you which nameservers to give the registrar, and checks each nameserver's glue at the parent registry.

A nameserver that is down takes every domain it names down with it, including sites hosted somewhere else. A provider built for DNS is the safer home for a zone. This server is the simpler one.

Connecting a provider

Cloudflare is the provider built in today. The credential is verified before it is stored, and it is sealed at rest.

klyrn dns connect --kind cloudflare --label "Acme Cloudflare" --token <token>
klyrn dns providers
klyrn dns disconnect 2

The token can be supplied in the KLYRN_DNS_TOKEN environment variable instead of on the command line. It must be an API token with Zone, DNS, Edit. A Global API Key is refused.

--account ties a connection to one hosting account instead of the whole server. A reseller uses it to give each customer their own credential. A single account may hold up to four connections.

Editing records

klyrn dns records example.com
klyrn dns set example.com A @ 203.0.113.10 --ttl 300
klyrn dns set example.com TXT _dmarc "v=DMARC1; p=none; rua=mailto:you@example.com"
klyrn dns set example.com MX @ mail.provider.net --priority 10
klyrn dns delete example.com <record-id>

Writable types are A, AAAA, CNAME, TXT, MX, SRV and CAA. NS and SOA cannot be written.

The TTL is 0 or 1 for the provider's automatic value, or between 60 and 86400 seconds. Record content is capped at 2048 characters.

The name guard applies to everyone, including administrators. A record can only be written when its name is a domain KLYRN hosts for that actor, or a name inside one. Anything else is refused with "KLYRN only edits DNS for the sites it hosts".

Point this site here

klyrn dns check example.com    # what each name resolves to, and whether that is here
klyrn dns point example.com    # create or update the A records for every name the site serves

point writes A records at TTL 300, unproxied, for every name the site answers for. It skips a name that is not in the zone. It also skips a name that is currently a CNAME and reports the target. Remove the CNAME first if this site should serve the name.

check never estimates propagation time. It tells you what the record says now.

A site behind Cloudflare

When the connected account holds a site's zone, the site's DNS tab gains a Cloudflare section, and the same five things are one command:

klyrn cloudflare example.com                 # is the proxy on, how it connects, does that work
klyrn cloudflare example.com ssl strict      # flexible | full | strict
klyrn cloudflare example.com proxy on        # on | off, for every name the site answers for
klyrn cloudflare example.com dev on          # bypass the cache for three hours
klyrn cloudflare example.com purge           # empty the zone's cache

The status says whether the combination works. Two combinations take a site down while the server is healthy. Full or Full (strict) in front of a site with no certificate here gives error 525 or 526. Flexible in front of a site that redirects to HTTPS gives a redirect that never ends. KLYRN refuses the changes that would cause either, with the reason.

Certificate before the switch

A site whose zone KLYRN can write gets its certificate through a DNS challenge, while the domain still points at the old server. It is issued within ten minutes of the site being created or the account being connected. Point the domain here afterwards.

The proxy stays as you had it

klyrn dns point changes the address and leaves the orange cloud alone.

The visitor's own address

nginx believes Cloudflare's CF-Connecting-IP header, from Cloudflare's published ranges only. Logs, allow and deny rules and login limits see the visitor's address.

Tokens

A token made under a profile or under an account both work. It needs Zone, DNS, Edit. The SSL mode, development mode and purge need Zone Settings, Edit and Cache Purge as well.

DNSSEC

For a zone this server is the nameserver for. Signing is two steps by two parties: this server signs, and the registrar anchors when you add the DS record there.

klyrn dns dnssec example.com          # how it is signed, and the DS record
klyrn dns dnssec example.com on
klyrn dns dnssec example.com off

Switching it on changes nothing for visitors until the DS record is at the registrar. Switching it off is refused while the registrar still publishes the DS record, because resolvers that validate would then refuse the domain. Remove the record there first.

Mail records

If mail is hosted elsewhere, your MX, SPF, DKIM and DMARC records point at that provider. If this server hosts the mail, the panel checks those records per domain. Where this server writes the zone, it publishes the missing DKIM and DMARC records in one click. They are ordinary records, and klyrn dns set writes them like any other. Nothing KLYRN does will overwrite them: point only touches A records for names the site serves.